A tech-stack signal: 500 Shopify stores checked for $1.45, and the 36 on Klaviyo with no review app

If you sell a Shopify app, run an e-commerce agency or sell anything that plugs into an online store, the best prospect list is defined by what a store already uses and what it doesn't. A store that pays for Klaviyo already spends on retention, so a review app or an SMS tool is an easy next conversation. A store still on Mailchimp is a migration project for a Klaviyo agency. A store with no email tool at all is a different pitch again.

The usual tool for this is a technology database like BuiltWith, which indexes the whole web. That is the right tool when you need every site that uses something. Its Basic plan is $295 a month for two technologies, with a one-month minimum. If you already have the list of domains (a CRM export, a lead list, a public ranking), you don't need the database. You need each domain checked once, and you can pay for that per domain.

We did that for 500 Shopify stores on 14 October 2026 with our domain-intel Actor on Apify. It reads each domain's public DNS records and one page, the homepage, and recognises 3,111 technologies. It costs $3 per 1,000 domains, so 0.3 cents a store. Every number below is from that run.

Step 1: a list of Shopify stores, for free

You can bring your own list. We wanted one anyone can rebuild, so we started from the Tranco list, a research ranking of the most visited sites, in its 13 October 2026 edition (N26LW).

Shopify serves stores on custom domains from one address block, 23.227.38.0/24, the address its help pages tell merchants to point their domain at. So a DNS lookup sorts a domain list for free: if the domain's A record is in that block, it is a Shopify storefront. We looked up the top 100,000 domains, found 921 on that block (Shopify's own domains left out), and took the 500 highest ranked, from rank 2,175 (barnesandnoble.com) to 75,938.

The method misses stores that put their own CDN in front of Shopify, but it doesn't add wrong ones: of the 470 homepages the Actor could read, 469 showed Shopify. The script is recipe-2-list.mjs; it reads DNS only and visits no website.

The input

{
  "domains": ["barnesandnoble.com", "nanit.com", "wyze.com", "daisonet.com", "chiikawamarket.jp"]
}

That is the whole input, with the full 500 in recipe-2-domains.txt. Three notes:

• domains takes bare domains, full URLs or email addresses. Each is cut down to its registrable domain and duplicates are merged, so a column of work emails from a CRM works as it is.
• checkWebsite, checkSsl and checkRegistration are all on by default. The tech stack needs checkWebsite. Turn the other two off if you only want the stack; the price is the same.
• Each website gets one robots.txt request and one homepage request. The Actor runs no JavaScript, so it sees what the page's HTML and headers name, not what a browser loads later.

What came back

• 484 rows from 500 domains in 7 minutes 12 seconds. 16 homepages didn't answer within 120 seconds; they return no row and cost nothing. At $3 per 1,000 domains plus a $0.00005 start fee, the run costs $1.45 on Apify's free or Starter plan, $1.09 on Scale and $0.80 on Business.
• 470 homepages were read. 10 answered with a bot-protection page and 4 timed out; those rows still have the DNS and email columns, with empty tech columns.
• 268 of the 470 stores (57%) show an email or SMS marketing tool. Klaviyo alone is on 218 (46%). Mailchimp is on 34, HubSpot 11, Brevo 10.
• 140 (30%) show a review app on the homepage, led by Yotpo (70) and Trustpilot (22).
• Email is hosted on Google Workspace at 196 of the 484 domains and Microsoft 365 at 164. 30 more receive mail through a filtering service such as Proofpoint or Mimecast, which hides the host behind it.
• DMARC, the DNS record that tells mailbox providers what to do with mail that fails sender checks: 111 domains reject, 134 quarantine, 215 only monitor (p=none) and 24 publish no record.

The stack, by category. Counts are stores out of the 470 homepages read; a store can use several tools in one category.

Sample rows

Ten of the 484, by Tranco rank. The review column is what the homepage shows.

Each row also carries the DNS host, MX records, SPF record, the full DMARC record (report addresses masked), CDN, hosting, every detected technology with its category and a confidence score, SSL issuer and days to expiry, and the registrar with creation and expiry dates. No registrant or contact details are collected. The flat version of all 484 is stores.csv.

The segment: Klaviyo, but no review app

The query is one line: Klaviyo in the email column and nothing in the reviews column. On the homepage data that gives 133 of the 218 Klaviyo stores. It looks like a great list for a review app. It mostly isn't, and this is the most useful thing we learned from the run.

Review widgets live on product pages. Many stores never show stars on the homepage. So we ran a free second pass: for each of the 133, open one product page and look for review apps there. It is recipe-2-product-check.py, about 140 lines. It uses Shopify's public /products.json to find one product, respects robots.txt and makes three requests per store.

• 125 of the 133 product pages were read. 89 of them had reviews: Judge.me on 30, REVIEWS.io on 13, Yotpo 10, Okendo 9, Trustpilot 8, Bazaarvoice 7, other review apps or the theme's own reviews block on the rest. Wyze, August and Lockly use Bazaarvoice; NZXT and Society6 use Okendo.
• 36 stores have Klaviyo and no reviews on either page. That is the real list, a quarter of the first answer.
• Klaviyo itself was on all 125 product pages too. Site-wide tools like an email platform, a chat widget or a consent banner load on every page, so the homepage read is right for them. Page-specific tools need the second pass.

The first ten of the 36, by Tranco rank:

All 36 are in segment-klaviyo-no-reviews-confirmed.csv; the homepage-only 133 are in segment-klaviyo-no-reviews.csv, with the product-page findings for each in product-check-klaviyo-no-reviews.json.

Some of the 36 will still have reviews somewhere: a big retailer like JB Hi-Fi may run its own system, and a few stores load widgets in ways a page read can't see. Look at the product page of anyone you plan to contact. The list is short enough for that.

More segments from the same run

The same 484 rows answer other questions with a different filter. None of these cost anything beyond the $1.45.

The lists are in the analysis folder: no email tool and confirmed on a product page, Klaviyo with DMARC missing or p=none, Mailchimp, not Klaviyo.

The DMARC rows come from DNS, so they don't need a second pass. Since 2024, Gmail has required anyone sending more than 5,000 messages a day to Gmail addresses to publish a DMARC record, and Yahoo has the same rule for bulk senders. p=none meets that rule but only asks for reports; it doesn't stop anyone sending mail in the store's name. Of the 218 Klaviyo stores, 96 are at p=none and 6 have no record. For a store whose revenue depends on its emails landing in the inbox, that is a concrete reason to talk.

The "no email tool" segment shrank less than the reviews one, from 202 to 131: 42 of the 173 product pages we could read showed an email tool the homepage didn't (Attentive on 13, Mailchimp 12, Klaviyo 8, Omnisend 8).

Read the list once

Three more things to know before you load it anywhere:

• What a page read can't see. Tools added through a tag manager or Shopify's customer-events pixels load after the page, so a one-page read misses them. That is most likely why Google Analytics, which Shopify's own Google app loads as a pixel, shows on only 73 stores while Microsoft Clarity shows on 156. Treat "none seen" as "not on the page", not "not used".
• The sample is big brands. Tranco ranks popularity, so these are well-known stores, 360 of them on .com. A list of small stores from a directory or your own CRM will have a different mix of tools.
• Some sites block automated requests. 10 of the 500 answered with a bot-protection page. The DNS and email columns are still right for those; only the tech columns are empty.

The working version: a sheet that fills itself

For a list you add to over time, we use an n8n workflow with Google Sheets. You paste domains into a tab, and each morning the new ones get their columns.

1. Schedule Trigger, every day at 10:00 (and a manual trigger for the first run).
2. Read the Domains tab in your Google Sheet.
3. Pick new domains: keeps the rows whose checkedAt is empty, so a domain is only paid for once.
4. Apify, Run actor and get dataset: runs domain-intel on them, with a $2 cap on the run.
5. Flatten for the sheet: one row per domain with emailMarketing, reviews, liveChat, bnpl, cookieConsent, analytics, emailProvider, dmarcPolicy and a klaviyoNoReviewApp flag (true or false).
6. Write results to the sheet: updates the same row, matched on domain.

Download tech-stack-signal-to-google-sheets.json. It is our standard domains-to-Sheets workflow with this article's columns added, and it leaves checkedAt empty for a domain that didn't answer, so it is tried again the next day at no charge. The plain version is domain-tech-and-email-setup-to-google-sheets.json.

Setup takes about five minutes:

1. Make a Google Sheet with a tab named Domains and two header cells: domain and checkedAt. Paste your domains under domain.
2. In n8n, open Workflows > Import from file and pick the JSON.
3. The workflow uses the verified Apify node (@apify/n8n-nodes-apify). n8n Cloud installs it from the canvas; on self-hosted n8n, add it under Settings > Community nodes.
4. In the Apify node, create an Apify API credential with your token from the Apify console (Settings > API & Integrations).
5. Paste the sheet ID into both Google Sheets nodes and pick your Google credential. Run it once by hand.

Then filter the sheet: klaviyoNoReviewApp is TRUE gives the homepage segment, and dmarcPolicy is none or missing gives the deliverability one.

Two limits. The $2 cap covers about 660 domains per run; for a bigger first batch, raise it in the Apify node ($3 per 1,000). And on Apify's free plan a run checks up to 100 domains, so a 500-row sheet fills over five mornings; any paid plan removes that cap.

If you work from Claude Code or another MCP client

With the Apify MCP server connected, this prompt runs the same check on your own list and builds the segments:

Use the Apify Actor locaihost/domain-intel on the domains in domains.txt (one per line).
Before running, tell me how many domains you are sending; the price is $3 per 1,000.
When it finishes, make a table with one row per domain: email marketing tools, review apps,
live chat, buy now pay later, email host and DMARC policy, from techCategories and the DMARC
fields. Mark rows where errors.tech is set as "homepage not read". Then list: stores with
Klaviyo and no review app, stores with no email marketing tool, and stores on Mailchimp but
not Klaviyo. Remind me that review apps usually sit on product pages, so the first list
needs a product-page check before I use it.

More ways to use the tech-stack signal

• Your own CRM. Export the website column of your accounts and run it. You learn which customers use a tool you integrate with, and which use a competitor's.
• Competitor customers. Gorgias against Zendesk, Yotpo against Okendo, OneTrust against Cookiebot: each is a filter on one column. A list of stores on a competitor's app is a list of switching conversations.
• Partner programmes. If you build a Klaviyo or Gorgias integration, the stores already paying for that tool are the ones who can install yours today.
• IT and email services. The email host column splits any list into Google Workspace and Microsoft 365 shops before the first call.
• Agencies. Run a prospect's domain and its five closest competitors before a pitch, and open with what they have and the others don't.
• Beyond Shopify. Nothing here is Shopify-only except the free list in step 1 and the product-page pass. The Actor works on any domain: WordPress, Webflow, SaaS companies, local businesses.

Notes

• The sample. The 500 highest-ranked domains in the Tranco top 100,000 (list N26LW, 13 October 2026) whose A record is in Shopify's 23.227.38.0/24 block: 921 matched, ranks 2,175 to 75,938 were used. It is a list of large, popular stores from many countries, not a random sample of Shopify.
• The run. Run fWhZBzHIOYeybUw0d on 14 October 2026 at 16:54 UTC, 1 GB of memory, 431.7 seconds, 484 domains charged. The product-page pass ran on 15 October 2026.
• Detection is evidence, not certainty. A technology counts only when its own script address, header or markup is on the page, never because a word appears in the text. Each item in techStack carries a confidence score.
• Reproduce it. The list script, run script, analysis script and product-page check are next to this post, with the computed results.

If you run this on your own list, post two numbers in the comments: how many domains you checked, and how much your first segment shrank after you looked at the product pages. That tells the next reader how far to trust a homepage read.

Source: public DNS records, homepages and product pages of 500 Shopify storefronts from the Tranco top 100,000, read by locaihost data on 14 and 15 October 2026.